The error simply states that somebody/something is trying to connect to SQL Server from IP address 172.16.30.227 using the sa account but using a wrong password.
SQL Server just rejected the connection and as far as SQL Server is concerned that is the end of it.
You won't find more information in the SQL Server logs that can help you find out who or what is trying to open that connection.
You can try logging on to the 172.16.30.227 machine and check scheduled tasks or the event log in hopes of finding an indication about what is failing there.
If it's an IP address you know (such as the server itself) it could be a script or a tool that has been scheduled before the sa password was changed or it could be something that was never configured right in the first place.
If it's an IP address you don't know, or is a workstation in your network somewhere it could be a malicious user trying to log on.
The only thing you can try to determine from SQL Server logs apart from the ip address is if there is a repetition pattern in the day or time of the error.